Unmanaged dependency checks failing at shared-resourcemapping

[suztomo]

"Unmanaged dependency check / unmanaged_dependency_check (pull_request)" checks are failing.

E.g., https://github.com/googleapis/java-storage-nio/pull/1449

https://github.com/googleapis/java-storage-nio/actions/runs/10304713767/job/28523846932?pr=1449

Run bom_absolute_path=$(realpath "google-cloud-nio-bom/pom.xml")
Running Unmanaged Dependency Check against /home/runner/work/java-storage-nio/java-storage-nio/google-cloud-nio-bom/pom.xml
This pull request seems to add new third-party dependency, [com.google.cloud.opentelemetry:shared-resourcemapping, com.google.cloud.opentelemetry:exporter-metrics], among the artifacts listed in google-cloud-nio-bom/pom.xml.

[suztomo]

They come from java-storage dependency: https://gist.github.com/suztomo/90f007ffd41153c1529902d36f20bafb

[suztomo]

~/java-storage $ mvn -pl google-cloud-storage  dependency:tree
...
[INFO] com.google.cloud:google-cloud-storage:jar:2.41.0
...
[INFO] +- com.google.cloud.opentelemetry:exporter-metrics:jar:0.31.0:compile
[INFO] |  +- org.slf4j:slf4j-api:jar:2.0.9:compile
[INFO] |  +- com.google.cloud:google-cloud-monitoring:jar:3.31.0:compile
[INFO] |  |  \- com.google.api.grpc:proto-google-cloud-monitoring-v3:jar:3.31.0:compile
[INFO] |  \- com.google.cloud.opentelemetry:shared-resourcemapping:jar:0.31.0:runtime

[suztomo]

It seems it was https://github.com/googleapis/java-storage/pull/2590 that broke the check (the previous pull request https://github.com/googleapis/java-storage/pull/2652 was green).

https://github.com/googleapis/java-storage/pull/2590#discussion_r1645005110 Ben wrote:

Ideally all of the otel version come from shared dependencies.

I'll follow up on this.

[suztomo]

Jesse has created b/356675340.